Over the last few years, the demand to provide networked communications has increased dramatically, and has resulted in enterprises of all sizes providing secure and reliable network access to mobile employees and telecommuters. As the costs of maintaining direct dial-up connections via modem pools and providing a private network infrastructure have grown substantially, a more cost-effective solution has been to use the Internet connections and virtual private network (VPN) servers. A VPN allows a remote client to connect to a corporate network by going directly through any public network, such as the Internet.
One of the technologies that facilitate a VPN is IP Security Architecture (IPSec), which offers an interoperable and open standard for building security into any Internet application. The primary services provided to the IP data packet by IPSec are data confidentiality and authentication. Confidentiality ensures that the data portion of the IP packet is unreadable by unauthorized entities, and the authentication service allows the recipient to be sure that the packet actually comes from the host identified by the source IP address. Both the authentication and confidentiality services are achieved through the use of cryptographic techniques.
The IPSec specification (found in RFC 2401) states that there are several ways to implement IPSec in a host or in conjunction with a router or firewall. The first method is to integrate IPSec into the native IP stack of the operating system the second method commonly referred to as “Bump in the Stack” (BITS) involves implementing IPSec “beneath” the IP stack and above the network drivers, while the third method known as “Bump in the Wire” (BITW) involves implementing IPSec in a hardware cryptographic processor.
The main advantage of integrating IPSec in the stack and BITS is that such a solution is considerably less expensive than BITW, as they are implemented in software. However, integrating IPSec in the stack requires the source code for the operating system to be available. If the source code is not available then the second method (BITS) is favored. The third method (BITW) is the most expensive implementation, as it requires additional hardware, although such specialized hardware implementations generally provide substantially higher performance in processing cryptographic functions.
However, on some operating systems, such as PALM® OS, it may not be feasible to intercept internet protocol (IP) packets at the network layer, due to the system architecture. Therefore, the methods described above may not be suitable to implement a driver at the network layer to perform operations on the IP packets.
It is therefore an object of this invention to mitigate at least one of these disadvantages.